FSMA Centers Around Preventive Controls Rule

AFI Staff Report

The Preventive Control for Human Food rule is the main component of the Food Safety Modernization Act. This article is designed to give foreign suppliers an overview of the rule’s requirements. Foreign suppliers must produce food that meets U.S. regulations and their importers will need to compile ongoing documentation that proves the food meets those regulations.

Domestic and foreign food facilities must conduct a hazard analysis and implement risk-based preventive controls (HARPC) for each food they manufacture, process, pack or hold. This HARPC plan must be contained in a written food safety plan and must be reinforced by management controls, including validation, monitoring, corrective actions and verification. Development of the food safety plan, selection and validation of preventive controls and certain other key required activities must be performed by a preventive controls qualified individual (PCQI) with specialized training or experience.

FDA has also updated its longstanding general food current good manufacturing practice (CGMP) regulations. The update of the CGMP regulations was not required by FSMA. It is something that had been in the works for several years and FDA used the HARPC rulemaking as an opportunity to complete it. For some suppliers, CGMP compliance will cover most HARPC requirements.

The changes to the CGMP regulations are fairly modest and include the following:

● Certain provisions that require prevention of contamination have been amended to also require prevention of allergen cross-contact.

● Certain provisions that require prevention of contamination (and now allergen cross-contact) of food and food-contact surfaces have been amended to extend the same protections to food-packaging materials.

● The sanitary operations regulation provides that food-contact surfaces used for manufacturing, processing, packing or holding low-moisture foods must be in a clean, dry and sanitary condition “before use” rather than “at the time of use.” The significance of this requirement is that it reflects FDA’s recognition that equipment used for low-moisture foods typically cannot be wet-cleaned. It must be dry-cleaned and, therefore, may accumulate dust particles during operation. FDA recognizes and accepts that dry-cleaning methods that do not include a sanitizing step may be necessary for low-moisture foods (such as chocolate and peanut products).

● Training is now required, not just recommended. Responsibility for compliance must be clearly assigned to supervisory personnel who have the education, training, or experience (or a combination thereof) needed to supervise production of clean and safe food.


Registered foreign facilities, unless exempt or subject to modified requirements, must perform a hazard analysis for each food they manufacture, process, pack or hold and implement preventive controls to significantly minimize or prevent any “hazards requiring a preventive control.”

Covered facilities are also required to implement “preventive control management components” to ensure their food safety system is operating as intended. These management components are monitoring, corrective actions and corrections and verification. Facilities must maintain extensive records demonstrating the operation of their HARPC plan.


The following are not subject to the HARPC requirements:

● Activities subject to FDA’s juice or seafood HACCP regulations;

● Activities subject to FDA’s low acid canned food (LACF) regulations (LACF regulations pertain to microbiological hazards. FSMA regulations apply for physical and chemical hazards);

● Manufacturing, processing, packing or holding of a dietary supplement

● Activities subject to FDA’s Produce Safety Rule;

● Alcoholic beverages (with some exceptions)

● Facilities solely engaged in the storage of raw agricultural commodities (RACs) (other than fruits and vegetables) intended for further distribution or processing (e.g., grain elevators and silos);

● Facilities solely engaged in the storage of packaged food that is not exposed to the environment;

● “Qualified facilities” (very small producers);

● “Farms”;

● Activities within the definition of “farm” conducted on “farm mixed-type facilities”; and

● Specified low-risk, on-farm activities performed by a small or very small business.

How HARPC Differs from HACCP

HARPC plan requirements were based largely on Hazard Analysis and Critical Control Points (HACCP) principles. However, there are significant differences between a HACCP plan and a HARPC plan. For example, a HACCP plan applies controls at critical control points (CCPs) and each CCP has a critical limit (i.e., a maximum or minimum value to which a biological, chemical or physical parameter must be controlled in order to prevent, eliminate or reduce a hazard to an acceptable level). A HARPC plan may include preventive controls at points other than CCPs, and preventive controls may or may not include critical limits. In addition, food safety measures addressed in prerequisite programs under HACCP may need to be addressed in preventive controls under HARPC.

Food Safety Plan

The owner, operator or agent in charge of each foreign facility must have a written food safety plan. The plan must address each food the facility manufactures, processes, packs or holds. The food safety plan is required to include the following elements:

1. A written hazard analysis;

2. Written preventive controls, including a written supply-chain program and a written recall plan;

3. Written monitoring procedures;

4. Written corrective action procedures; and

5. Written verification procedures, including validation of preventive controls.

The food safety plan must be prepared by, or its preparation must be overseen by, one or more PCQIs. The plan must be signed and dated by the owner, operator, or agent in charge of the facility upon its completion and upon any modification of the plan. (The agent in charge is not the FDA facility registration agent.)

Hazard Analysis

Each facility must conduct a hazard analysis for each type of food manufactured, processed, packed or held at the facility to determine whether there are any hazards requiring a preventive control. A “hazard requiring a preventive control” is defined as:

… a known or reasonably foreseeable hazard for which a person knowledgeable about the safe manufacturing, processing, packing, or holding of food would, based on the outcome of the hazard analysis (which includes an assessment of the severity of the illness or injury if the hazard were to occur and the probability that the hazard will occur in the absence of preventive controls), establish one or more preventive controls to significantly minimize or prevent the hazard in a food and components to manage those controls (such as monitoring, corrections or corrective actions, verification, and records) as appropriate to the food, the facility, and the nature of the preventive control and its role in the facility’s food safety system.

The foreign facility must identify and evaluate, based on experience, illness data, scientific reports and other relevant information, about “known or reasonably foreseeable hazards.” A “known or reasonably foreseeable hazard” is defined as “a biological, chemical (including radiological), or physical hazard that is known to be, or has the potential to be, associated with the facility or the food.” Chemical hazards include radiological hazards, heavy metals, pesticide residues, drug residues, natural toxins, decomposition, unapproved food additives, unapproved color additives, undeclared food allergens and undeclared ingredients associated with a food sensitivity (e.g., sulfites, Yellow No. 5).

The hazard identification must include hazards that occur naturally in the food, hazards that may be unintentionally introduced and hazards that may be intentionally introduced for purposes of economic gain.

The hazard evaluation must consider the following:

● An assessment of the severity of illness or injury if the hazard were to occur and the probability that the hazard will occur in the absence of preventive controls;

● An evaluation of environmental pathogens whenever a ready-to-eat (RTE) food is exposed to the environment prior to packaging and the packaged food does not receive a treatment or otherwise include a control measure (such as a formulation lethal to the pathogen) that would significantly minimize the pathogen;

● The effect of the following factors on the safety of the finished food:

● The formulation of the food;

● The condition, function, and design of the facility and equipment;

● Raw materials and other ingredients;

● Transportation practices;

● Manufacturing/processing procedures;

● Packaging and labeling activities;

● Storage and distribution;

● Intended or reasonably foreseeable use of the food (e.g., whether the food is known to be eaten raw by some consumers, even though it is supposed to be cooked, such as cookie dough and dry soup mixes);

● Sanitation, including employee hygiene; and

● Any other relevant factors, such as geographic, temporal (i.e., weather-related), or agricultural factors (e.g., levels of aflatoxin or other natural toxins may depend on weather).

Preventive Controls

The facility must identify and implement preventive controls (including at CCPs, if any) to provide assurances that any hazards requiring a preventive control will be significantly minimized or prevented. “Preventive controls” are defined as:

… those risk-based, reasonably appropriate procedures, practices, and processes that a person knowledgeable about the safe manufacturing, processing, packing, or holding of food would employ to significantly minimize or prevent the hazards identified under the hazard analysis that are consistent with the current scientific understanding of safe food manufacturing, processing, packing, or holding at the time of the analysis.

Preventive controls are required to include, as appropriate to the facility and the food, the following:

● Process controls;

● Food allergen controls;

● Sanitation controls;

● Supply-chain controls;

● A recall plan; and

● Any other necessary controls.

Supply Chain Program

A “receiving facility” is required to implement a risk-based supply chain program for any raw materials or other ingredients for which the receiving facility has identified a hazard requiring a “supply-chain-applied control.” The program must provide assurance that a hazard requiring a supply-chain-applied control has been significantly minimized or prevented. The supply-chain program must include:

● Using approved suppliers;

● Determining appropriate supplier verification activities (including their frequency);

● Conducting supplier verification activities;

● Documenting supplier verification activities; and

● When a supply-chain applied control is applied by an entity other than the receiving facility’s supplier, either: (1) verifying a supply-chain-applied control applied by that other entity and documenting verification; or (2) obtaining documentation of an appropriate verification activity from that other entity, reviewing and assessing the documentation, and documenting that review and assessment.

Supplier Verification Activities

Appropriate supplier verification activities to be undertaken by a facility include the following:

● Onsite audits, conducted by a qualified auditor;

● Sampling and testing of the raw material or other ingredient;

● Review of the supplier’s relevant food safety records; and

● Other appropriate supplier verification activities based on supplier performance and the risk associated with the raw material or other ingredient.

In approving suppliers and determining appropriate supplier verification activities and their frequency, the foreign receiving facility is required to consider the following:

● The hazard analysis for the food in which the raw material or other ingredient is used;

● The entity or entities that will control the hazard in the raw material or other ingredient;

● Supplier performance, including (1) the supplier’s procedures, processes, and practices related to the safety of the raw material or other ingredient; (2) applicable FDA food safety regulations and the supplier’s compliance with those regulations (including any Import Alerts or other compliance actions related to food safety); and (3) the supplier’s food safety history relevant to the raw material or other ingredient (including audit results, testing results, and responsiveness of the supplier in correcting problems); and

● Any other factors as appropriate and necessary, such as storage and transportation practices.

Corrective Actions

If a foreign receiving facility determines that a supplier is not controlling hazards requiring a supply-chain-applied control, the receiving facility must take and document prompt corrective action to ensure raw materials and other ingredients from the supplier do not cause food manufactured or processed by the foreign receiving facility to be unsafe.

A foreign receiving facility is required to approve its suppliers and document that approval before receiving raw materials or other ingredients from those suppliers. In addition, the receiving facility must implement written procedures for receiving raw materials and other ingredients that ensure they are received only from approved suppliers.


A facility must perform the following “verification” activities, as appropriate to the nature of the preventive control and its role in the facility’s food safety system:

● Validate that the preventive controls are adequate to control the identified hazards;

● Verify that monitoring is being conducted as required by the written monitoring procedures;

● Verify that appropriate decisions are being made about corrective actions;

● Verify that the preventive controls are consistently implemented and are effectively and significantly minimizing or preventing the identified hazards; and

● Reanalyze the food safety plan, as required.

● The plan must be reanalyzed at least once every three years. It also must be reanalyzed whenever:

● A significant change in the activities conducted at the facility creates a reasonable potential for a new hazard or a significant increase in a previously identified hazard;

● The facility becomes aware of new information about potential hazards associated with the food;

● Appropriate after an unanticipated food safety problem (i.e., a preventive control is not properly implemented and a corrective action procedure has not been established; a review of records finds that the records are not complete, the activities conducted did not occur in accordance with the food safety plan or appropriate decisions about corrective actions were not made); and

● A preventive control, combination of preventive controls, or the food safety plan as a whole is found to be ineffective.

The reanalysis must be performed, or its performance overseen by, PCQI and documented in records.


A facility must establish and maintain the following records:

● The written food safety plan (including the hazard analysis, preventive controls, monitoring procedures, corrective action procedures, verification procedures and recall plan);

● Documentation of the basis for not establishing a preventive control for an identified hazard;

● Records documenting the monitoring of preventive controls;

● Records documenting corrective actions;

● Records documenting verification, including, as applicable: validation, verification of monitoring, verification of corrective actions, calibration of process monitoring and verification instruments, product testing, environmental monitoring, records review, and reanalysis of the food safety plan;

● Records documenting the supply-chain program; and

● Records documenting the training of the preventive controls qualified individual and the qualified auditor, as applicable.

Most records are required to be retained for at least two years.


Businesses with 500 or more employees had to comply by Sept. 19, 2016. Small businesses (businesses with fewer than 500 full-time-equivalent employees) will have to comply by Sept. 18, 2017. Very small business (average worldwide sales of less than $1 million over the past three years) will have to comply by Sept. 18, 2018.

Association of Food Industries
3301 Route 66, Ste. 205, Bldg. C
Neptune, NJ 07753
(732) 922-3008 • Fax: (732) 922-3590
Email: info@afius.org